📦Colddbox

ColddBox Easy is a Wordpress machine with an easy level of difficulty, highly recommended for beginners in the field.

1. Reconnaissance

  • Scanning the network to find vulnerable machine's IP

nmap -sn 192.168.10.0/24
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-17 10:06 IST
Nmap scan report for 192.168.10.1
Host is up (0.0032s latency).
MAC Address: 52:54:00:12:35:00 (QEMU virtual NIC)
Nmap scan report for 192.168.10.2
Host is up (0.0032s latency).
MAC Address: 52:54:00:12:35:00 (QEMU virtual NIC)
Nmap scan report for 192.168.10.3
Host is up (0.0018s latency).
MAC Address: 08:00:27:1C:76:C3 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.10.12
Host is up (0.0014s latency).
MAC Address: 08:00:27:1F:03:A5 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.10.11
Host is up.
Nmap done: 256 IP addresses (5 hosts up) scanned in 2.07 seconds

  • We find the IP of the vulnerable machine to be 192.168.10.12

2. Scanning

2.1 Nmap

  • Using nmap to find the open ports and their services

  • We find 2 open ports, tcp ports 80 and 4512 with a web server and ssh running respectively

2.2 Directory Enumeration

  • Brute forcing directories using gobuster to find any hidden directories

  • We find the directory wp-admin and enumerating further through wappalyzer we can conclude that it is a WordPress site.

3. Initial Foothold

3.1 WPScan

  1. To enumerate the users we use -eu

  • We get 4 potential usernames:

    • the cold in person

    • c0ldd

    • hugo

    • philip

  1. Brute-forcing password using a word list with -P

We get c0ldd : 9876543210

  1. Using these credentials, we can login to the wp-admin page and upload a php reverse shell to Appearance>Editor>template header where url is http://192.168.10.12/wp-admin/theme-editor.php?file=header.php&theme=twentyfifteen

    • Using the reverse shell /usr/share/webshells/php/php-reverse-shell.php ,appending it to the header file template and updating it to use port 9001

    • Starting nc -lvnp 9001

    • Navigating to the headers tab under appearance to trigger the reverse shell.

4. Privilege Escalation

4.1 wp-config.php

  • Stabilizing the shell using python3 -c 'import pty;pty.spawn("/bin/bash")'

  • We are the user www-data

  • Enumerating the current directory we find a wp-config.php file in /var/www/html

We find the database to be MySQL with cOldd : cybersecurity as login credentials

4.2 Escalation

  1. c0ldd

  • Using the credentials to login as user c0ldd

  • User.txt

  1. Root

  • using sudo -l, we find c0ldd can run these processes as root:

  • Use SUDO privilege escalation on vim from GTFObins : vim -c ':!/bin/sh'

  • root.txt

PreviousVulnhubNextCrypto Bank

Last updated